dfdcvip[.]org

Analysis confirms that dfdcvip.org was operated as a high‑risk cryptocurrency impersonation site targeting Coinbase users. The site presented a page title of “Coinbase”, aligning with the claimed brand target. Registration data shows the domain was created on 11 October 2025 through Dominet (HK) Limited, and it uses Cloudflare nameservers (jill.ns.cloudflare.com, thaddeus.ns.cloudflare.com). The domain resolved to IP 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No TLS certificate was observed, leaving the site unencrypted and exposing any credentials entered over HTTP.

Reputation services rate the domain poorly: Scamadviser assigns a trust score of 1 / 100, Google Safe Browsing flags it for social engineering, and PhishDestroy has already taken the site offline. VirusTotal reports that 15 of 95 scanned security vendors flagged the domain as malicious. AlienVault OTX references the domain in three separate threat pulses, and it appears on one external blocklist. The combination of a low trust score, brand impersonation in the title, and multiple independent detections indicates a coordinated crypto‑scam campaign.

Defenders should ensure the domain and its resolving IP are added to inbound and outbound blocklists, enforce DNS sink‑holing for the host, and update web‑proxy and email filtering rules to drop any traffic bearing the “Coinbase” page title or referencing the domain. Continuous monitoring of Cloudflare‑hosted IP ranges for similar registration patterns is advised, as adversaries often reuse the same infrastructure. Users should be reminded that legitimate Coinbase communications never originate from domains lacking a valid TLS certificate and that any unsolicited requests for login credentials or crypto transfers should be reported to the official Coinbase abuse channels.